In today’s digital economy, connectivity is everything and the ability to deliver always-on digital experiences to customers and employees — no matter where they are — is becoming a key competitive differentiator. The digital supply chain of today can be long, winding, and distributed, connecting over networks that you own and the ones you don’t, like cloud provider networks and the Internet itself.
As this transfer of data between people, nodes, and locations becomes more prolific, the subject of moving data, or ‘data in flight’, is now a consideration for any organization concerned with data sovereignty and compliance. More often than not, when we discuss the idea of data sovereignty, we’re talking about data at rest. That is, the primary location of where data is stored in a cloud infrastructure. However, as the IT perimeter becomes increasingly borderless, data sovereignty is no longer just about data at rest.
The journey data takes to get from point A to point B can be difficult to track and can sometimes take less desirable routes to get to its destination. Due to the complex rules of some cloud providers’ routing decisions, we see some cases where domestic traffic, intended for a domestic destination, is diverted to servers in another country. This kind of decision-making can create an elevated risk for the customer organization, especially if they do not anticipate this eventuality and/or have no way to monitor or detect it independently.
So why has ‘data in flight’ been a slept on data sovereignty issue? And how can organizations ensure that data ‘in flight’ is controllable - to some degree?
Neil Miller is the Technical Leader at Cisco ThousandEyes EMEA.
Connections beyond borders
The distributed nature of today’s organizational structures and IT infrastructure means that data is rarely kept in one place. From edge-based collection points to a central warehouse or lake, through data pipelines, and in and out of analytics models, keeping tabs of where data goes on its journey can be tricky. Especially without ownership over the networks the data travels via.
Pair this with new approaches to data storage, and the widespread adoption of cloud computing services, and we’re navigating new data sharing practices that easily transcend geographical barriers. Within this new context, sovereignty conscious organizations will increasingly require more transparency and visibility into the path data takes between two points of connection, and into any route deviation, due to prevailing or dynamic network conditions, for quick identification and verification.
Possible implications from re-routing
Cloud provider traffic routing decisions are based on complex rules that take into account the ambient, changeable conditions of internet-connected networks. These decisions about where to send data traffic may not also be apparent or desirable in terms of where data goes on its journey.
While the routing of data through a second country is unlikely to be nefarious, any change to the in-flight path taken by data creates uncertainty. It may open an organization up to security or geopolitical risks, or could degrade the performance of the application or use case.
A sudden change in route could also impact an organization's disaster recovery planning (DRP), workflow performance, and the service-level agreements (SLAs) that govern and set out minimum standards in this area. A purposeful decision made by an organization for the sake of data sovereignty over in-flight data — such as shifting internet service providers (ISPs) — could add milliseconds, or even seconds, of latency or delay to the round-trip time for traffic movement. This could mean a temporary reduction in transaction processing capacity that will need to be communicated to users, or it could be more serious, rendering a workflow or application completely unusable.
In these cases, organizations need to have means to understand the SLA impact of data transit paths so they can raise awareness of that impact and/or compensate for it.
How can IT teams get better visibility of these pathways?
For sovereignty-conscious organizations, having greater visibility over these networks starts with implementing the right monitoring tools. Adopting solutions that monitor pathways and give IT teams a better understanding of decisions that could change the path data is on, means they have the right information to intervene if needed.
For example, if data in flight is suddenly detected changing course to a less favourable route, then DRP mechanisms may need to kick in to avoid exposing the data to risks. A mitigation may also be required to address this change, and that would ideally trigger automatically as the anomalous route is identified.
Another appropriate mitigation may be to purposely shift traffic across to a backup or alternative ISP, and re-advertise the corporate network there. The outcome of routing in-flight traffic via their network de-risks an active situation and produces more managed and controlled outcomes.
Future ‘flight’
Knowing where data is and the path it’s taking between two points at all times is critical for many organizations operating in the digital world. Inventory and path visualization should be used to make all possible network paths — and the complex peering relationships that underpin those paths — transparent and observable for IT teams.
